CVE-2018-14647 Denial of service in Python
Attackers can cause denial of service in Python applications by sending crafted XML documents that trigger hash collisions in the Expat parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14647?
CVE-2018-14647 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 25 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
Which versions are affected by CVE-2018-14647?
It affects 8 products.
Linux distribution packages (9)
python SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.6.9-40.21.2 |
python-base SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.6.9-40.21.1 |
python-doc SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.6-8.40.21.1 |
python SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.6.9-40.21.2 |
python-base SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.6.9-40.21.1 |
python-doc SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.6-8.40.21.1 |
python SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.6.9-40.21.2 |
python-base SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.6.9-40.21.1 |
python-doc SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.6-8.40.21.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Python Python, Redhat Enterprise Linux Desktop and 2 more.
How do I fix CVE-2018-14647?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-14647 being exploited?
There is no known exploitation of CVE-2018-14647 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-14647, DEBIAN-CVE-2018-14647, GHSA-gvw2-fvqg-v8mm, PSF-2018-5, SUSE-SU-2018:3156-1, UBUNTU-CVE-2018-14647.